Lucene search

[email protected]CVE-2019-8275

HistoryMar 08, 2019 - 11:29 p.m.

CVE-2019-8275

2019-03-0823:29:00

CWE-170

[email protected]

web.nvd.nist.gov

cve-2019-8275

ultravnc

revision 1211

null termination vulnerabilities

vnc server

out-of-bound data access

remote users

network exploit

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.107 Low

EPSS

Percentile

95.1%

JSON

UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote users. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1212.

Affected configurations

NVD

Node

uvncultravncRange<1.2.2.3

Node

siemenssinumerik_access_mymachine\/p2pRange<4.8

siemenssinumerik_pcu_base_win10_software\/ipcRange<14.00

siemenssinumerik_pcu_base_win7_software\/ipcRange≤12.01

CPENameOperatorVersion
uvnc:ultravncuvnc ultravnclt1.2.2.3

CPE	Name	Operator	Version
uvnc:ultravnc	uvnc ultravnc	lt	1.2.2.3

CNA Affected

[
  {
    "product": "UltraVNC",
    "vendor": "Kaspersky Lab",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.2.3"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf

cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf

ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-022-ultravnc-improper-null-termination/

us-cert.cisa.gov/ics/advisories/icsa-21-131-11

www.us-cert.gov/ics/advisories/icsa-20-161-06

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.107 Low

EPSS

Percentile

95.1%

JSON

Related for CVE-2019-8275

prion1 cvelist1 nvd1 ics3